Create a custom indicator field in the Fields tab in Cortex XSIAM. Add specific indicator information to indicator layouts and types.
Indicator fields are used to add specific indicator information to indicator types and layouts. When you create an indicator field, you can associate the field to a specific indicator type or to all indicator types.
Go to → → → → .
Click New Field.
In the Basic Settings tab, add the following:
Field
Description
Field Type
Determines the acceptable values for the field. You can add the following field types:
Boolean (checkbox)
Date picker
Grid (table): Include an interactive, editable grid.
HTML: Create and view HTML content, which can be used in any type of indicator. By default, HTML fields do not use theme styles.
Long text: The long text is analyzed and tokenized, and entries are indexed as individual words, enabling you to perform advanced searches and use wildcards. Long text fields cannot be sorted and cannot be used in graphical dashboard widgets. While editing a long text field, pressing enter will create a new line. Case insensitive.
Markdown: Add markdown formatted text as a Template which will be displayed to users in the field after the indicator is created. Markdown lets you add basic formatting to text to provide a better end-user experience.
Multi-select / Array: Includes two options:
Multi-select from a pre-filled list
An empty array field for the user to add one or more values as a comma-separated list
Number: Can contain any number. The default is 0.
Short text: Short text is treated as a single unit of text, and is not indexed by word. Advanced search, including wildcards, is not supported. Short text fields are case sensitive by default but can be changed to case insensitive when creating the field. While editing a short text field, pressing enter will save the change. Maximum length 60,000 characters. Recommended use is one-word entries. Examples: username, email address, etc.
Single select
Tags
URL
Mandatory
If selected, this field is mandatory when used in a form.
Field Name
A meaningful display name for the field. After you type a name, you will see below the field that the Machine name is automatically populated. The field’s machine name is applicable for searching and the War Room CLI.
Tooltip
An optional tooltip for the field.
Placeholder
Optional text to display in the field when it is empty. This text will appear in the layout, but not in the created indicator. Available for Short text, Long text, Multi-select / Array, and Tags.
Configure the attributes.
Field
Description
Script to run when field value changes
The script that dynamically changes the field value when script conditions are met. For a script to be available, it must have the field-change-triggered-indicator tag, when defining a script. For more information, see Indicator field trigger scripts.
Add to all indicator types
Selected by default, which means this field will be available to use in all indicator types.
Clear the check box to select the indicator types to add the field.
Save the field.
The indicator field appears in the layout(s) of the indicator type(s) you add it to.
You can now Map Custom Indicator Fields.